Quantum key distribution network and quantum security communication network including the same

Abstract

The present invention relates to a quantum key distribution network comprising a quantum key distribution layer comprising a plurality of pairs of emitters and receivers, and a plurality of core nodes and edge nodes, and a key management layer adapted to exclusively receive XORed keys from the core nodes, mix the XORed keys from the core nodes, and send the mixed XORed key to the edge nodes of the QKD layer to generate a shared key between the edge nodes.

Description

[Technical field]

[0001] The present invention relates to the field of quantum key distribution networks, and more particularly to a method and system for improving the security of quantum key distribution networks. [Background technology]

[0002] The present invention provides a method for improving the security of a quantum key distribution network (QKDN). Quantum key distribution (QKD) is widely known to perform secure distribution of secret keys between distant users. However, QKD links are point-to-point, commonly called Alice and Bob, and are typically limited to distances of 100 km in today's commercial systems. To extend this distance and perform key distribution over complex topologies, QKDNs are commonly used that include several QKD links bonded together at so-called Trusted Nodes (TNs). Today, all keys processed in a TN are publicly visible at the nodes. Therefore, the nodes must be well protected and trusted by all users of the QKDN.

[0003] A key management layer (KML) is needed to generate end-to-end keys for distant nodes. In standard practice, all QKD keys are stored in this layer. From these keys in KML, the end-to-end keys are calculated. The end-to-end keys are then sent to the user network, which consists of a separate upper layer known as the Service Layer (SL) or Application Layer (AL). KML, which must connect to all nodes, is the most exposed layer. In conclusion, a hacker could try to break into KML and obtain the QKD keys.

[0004] Therefore, there is a need for a secure QKDN that allows end-to-end key exchange without the risk of being hacked by compromising the KML.

[0005] In most of the literature, there is a separation between the QKDN, which generates and distributes keys, and the user network, which includes various key users that use the keys provided by the QKDN, as shown in Figures 1-3. We refer to the complete network, which includes both the QKDN and the user network, as the Quantum-Secure Communication Network. However, it should be noted that the term QKDN is sometimes adopted in the literature to cover the complete network (see, for example, a recent review on QKDN, "Quantum Key Distribution: A Networking Perspective," ACM Computing Surveys, Vol. 53, No. 5, September 2021, Article 96, pp. 1-41, which explicitly describes a hierarchy of three different layers).

[0006] As mentioned above, today, all QKDNs are based on trusted nodes (TNs). A TN contains two or more QKD systems. The TN is used to combine the keys generated by the QKD systems, thus resulting in long-distance key exchanges and the ability to have complex topologies. We will call the keys generated directly by the QKD devices QKD keys. These QKD keys are combined in various ways to generate other keys that will be used by users. In particular, two QKD keys can be combined with a bitwise addition, also known as an XOR operation, to generate what we call an XORed-key. From the Shannon information theory, it is not possible to use an XORed-key to gain knowledge of two corresponding QKD keys. The QKD keys represent the most valuable elements in the QKDN and must be managed with the highest possible security. However, in the TN, the QKD keys are stored in KML and thus become publicly available if the TN is not secure.

[0007] For management purposes, the network is logically divided into at least three layers as shown in Figures 1-3, where the QKDN comprises a quantum layer (QL) where the QKD system generates the QKD keys, and a key management layer (KML) where the keys are managed. The user network comprises a service layer (SL) or application layer (AL) where the keys are used by various devices. In the literature, various other layers have been added, such as a QKDN control layer. In all existing architectures, the QKD keys start at the QL, pass through the KML where they are stored and combined to generate the end-to-end keys. These keys are then sent to the SL where they are used by the end users.

[0008] Today, KML receives QKD keys from QKD devices, stores them for later use, then combines them to generate end-to-end keys and delivers them to end users. It also needs to receive commands from end users requesting keys for communication. This layer is therefore the most sensitive and potentially exposed to hackers. Since QKDN must be designed to be quantum-safe, providing a way for KML to be quantum-safe is a tough task. In particular, it cannot rely on existing public key infrastructures that quantum computers would break.

[0009] In this regard, the main objective of the present invention is to solve the above problems, and more particularly to provide a QKDN architecture in which the KML does not contain the private key. Summary of the Invention

[0010] The above problems are solved by the present invention, which is a novel architecture of the QKDN, which ensures that the KML does not contain the QKD key. In principle, with the present invention, the KML can be completely public. In practice, to improve security, a certain level of protection can be added using standard encryption means. Thus, the present invention simplifies the architecture of the QKDN and improves security.

[0011] The present invention provides a method to combine the QKD keys before sending them to the KML, ensuring that the KML does not contain the private key. Essentially, a hacker who successfully penetrates the KML (by breaking the underlying encryption, or by various means such as stealing passwords, or by social engineering) cannot access the QKD keys. This method simplifies the management of private keys and improves the security of the QKDN.

[0012] Thus, a first aspect of the present invention relates to a quantum key distribution network comprising a quantum key distribution layer comprising a plurality of pairs of emitters and receivers, and a plurality of core nodes and edge nodes, and a key management layer adapted to exclusively receive XORed keys from the core nodes and to transmit the XORed keys and combinations thereof to edge nodes of the QKD layer.

[0013] Preferably, the key management layer does not contain or store the QKD keys.

[0014] According to a preferred embodiment of the present invention, the quantum key distribution network provides at least one additional layer of security above the key management layer, including standard asymmetric cryptography, such as RSA, ECC, Post Quantum Cryptography (PQC), etc.

[0015] Advantageously, the link between the edge node and the key user layer is local and within the protected area.

[0016] Preferably, the core node includes at least two QKD devices and is configured to temporarily store QKD keys, compute XORs of the QKD keys, and transfer the XORed keys to the KML.

[0017] Advantageously, after the core node calculates the XOR of the QKD keys, it destroys the corresponding QKD keys.

[0018] According to a preferred embodiment of the present invention, the edge node includes at most one QKD device and is configured to receive the XORed key from the KML, perform another XOR with itself and the corresponding QKD key to obtain the final QKD key and forward it to the SL.

[0019] A second aspect of the present invention is a quantum secure communications network comprising the quantum key distribution network of the first aspect and a service layer configured to receive a key from an edge node of the quantum key distribution layer.

[0020] Advantageously, the link between an edge node and its service layer is local and does not leave the protection area.

[0021] A third aspect of the present invention is a quantum key distribution method performed in the quantum security communication network of the second aspect, comprising the steps of generating a QKD key between two nodes in a QKD layer, at least one of the nodes being a core node, storing the QKD key in both nodes, performing an XOR operation on the QKD key to become an XORed key in the core node, preferably erasing the corresponding QKD key in the core node, sending the XORed key to KML for storage, mixing the XORed key to generate a mixed XORed key, then sending the mixed XORed key to an edge node, and performing another XOR operation at the edge node with itself and the corresponding QKD key to obtain the final QKD key. [Brief description of the drawings]

[0022] Further particular advantages and features of the present invention will become more apparent from the following non-limiting description of at least one embodiment thereof, which refers to the accompanying drawings. [Figure 1] 1 is a schematic diagram of a conceptual structure of a conventional QKDN and a user network. [Diagram 2] FIG. 1 illustrates conventional key management operations in a QKDN and a user network. [Diagram 3] FIG. 1 is a diagram of a conventional structure of a QKDN and a user network. [Figure 4] A diagram showing a schematic representation of the architecture of a QKDN and a user network according to a preferred embodiment of the present invention. [Diagram 5] A diagram showing the organization and concept of core nodes and edge nodes. [Figure 6] FIG. 2 illustrates a QKD layer according to the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0023] This detailed description is intended to explain the invention in a non-limiting manner, since any feature of one embodiment may be advantageously combined with any other feature of another embodiment.

[0024] Figure 1 is a schematic diagram of the conceptual structure of the QKDN and the user network. It presents the different layers of the QKDN and their relationships as recommended by the International Telecommunication Union. Keys are generated in the QL by the QKD module and transferred to the KML. They are combined in the KML to provide an end-to-end final key, which is transferred in the user network to the SL. In this topology, there is one extra layer, the QKDN control layer, which includes one QKD controller in each node. In addition, the QKDN manager and the user network manager are responsible for the operation of the network.

[0025] Figure 2 illustrates a traditional key management operation in a QKDN. It describes the three main layers and shows how a key is stored in KML and hops from node 1 to node 4, thus generating the end-to-end key between node 1 and node 4.

[0026] Figure 3 shows the conventional structure of the QKDN and the user network. The structure of the QKDN is described, especially the control links connecting the various elements. The Key Management (KM) module that stores and combines keys is structured not only in the TN but also in the KML. Links to the outside world may expose an attack surface.

[0027] 4 shows a schematic representation of the architecture of the QKDN and the user network according to a preferred embodiment of the present invention. In this architecture, the QKDN includes two layers.

[0028] - The QKD layer, which contains all the QKD devices. The QKD layer is divided into two types of nodes: core nodes, which contain several QKD devices and deliver the XORed keys to the KML, and edge nodes, which contain at most one QKD device, receive the XORed keys from the KML, and provide the final keys to the SLs in the user network.

[0029] The KML, receiving the XORed keys from the core nodes of the QKD layer, mixes these XORed keys as requested by two edge nodes, preferably by requesting them to build an end-to-end secure key between them, and transmits these mixed XOR keys to these edge nodes. In the present invention, the KML is characterized by the fact that it does not contain or store the QKD keys.

[0030] In addition, user networks, including SLs, receive keys from edge nodes of the QKD layer to use the keys in various applications. The links between the edge nodes and their key users are local and do not leave the protected area.

[0031] The architecture of the QKDN according to the preferred embodiment of the present invention includes two main features.

[0032] A first feature of the invention is that KML is configured not to contain the QKD keys. This significantly reduces the security requirements of KML. This is obtained by the fact that the QKD layer is configured to only send XORed keys to KML. These XORed keys are stored and managed in KML. These XORed keys are used upon request from two users to produce a common secret end key.

[0033] The second feature is that the TN in the QKD layer is separated into two types of nodes: core nodes and edge nodes.

[0034] Figure 5 shows the organization and concept of core nodes and edge nodes. Core nodes contain at least two QKD devices. Core nodes are used to combine QKD keys into XORed keys and transfer them to KML. Core nodes are only connected to the higher KML and not to the lower SL.

[0035] More specifically, the role of the core node is to temporarily store the QKD keys, calculate the XOR of the QKD keys as soon as the QKD devices are available, transfer the XORed keys to KML, and destroy the corresponding QKD keys. The core node must be designed to only allow the transport of the XORed keys to KML. This can be obtained, for example, by restricting the set of commands that the core node can understand. Preferably, the system should be designed such that the KML cannot request the QKD keys from the core node at all. The core node temporarily stores the QKD keys from the QKD devices, performs the XOR between the two QKD keys coming from the two QKD devices, sends the XORed keys to KML, and destroys the corresponding QKD keys. After that, all key management and storage is done for the XORed keys in KML.

[0036] An edge node includes at most one QKD device. Preferably, an edge node is linked to a single core node. If the edge node is outside the local protection area of ​​the corresponding core node, the edge node is linked to the single core node by the QKD device. The key exchanged between the edge node and the core node is a secure QKD key. If the edge node is contained within the local protection area, the key exchange can be performed by simple means. For example, the edge node can generate the key using a quantum random number generator (QRNG) and transfer the key to the core node using a standard communication link.

[0037] Edge nodes need to store their QKD keys until they are required to be used, and therefore need to have secure storage facilities. The edge node receives the XORed key from the KML and performs another XOR operation with itself and the corresponding QKD key to obtain the final QKD key that will be sent to the application layer. Note that devices using the key need to be in the same physically protected area as the edge node. Some algorithmic protection can be added to the node.

[0038] Figure 6 shows a QKD layer according to the present invention. More specifically, the QKD layer is represented by an example of node numbering (edge ​​nodes are labeled with letters and core nodes are labeled with numbers) and the corresponding QKD keys. The key exchange between A and B is described below.

[0039] The QKD layer constantly generates QKD keys between various nodes. The keys between the core nodes and the edge nodes (e.g., K A1 ) are stored both in edge nodes until the key is used, and temporarily in core nodes. 12 ) are temporarily stored in both nodes. For the core node, the two QKD keys, e.g., K 12 and K 23 As soon as it is available, the node will send the XORed key:

number

number

number

[0040] KML calculates the new mixed XORed key:

number

number

[0041] Similarly, the XORed key at node 3 is

number

[0042] At node 4:

number

[0043] KML calculates the new mixed XORed key:

number

[0044] Here, node A and node B share the same QKD keys, which are ultimately sent to the SL below for use.

[0045] Note that KML can decide how to mix the XORed keys and to whom to send the mixed keys. For example, KML can mix all the keys and send them all to node B. In this case, nodes A and B will receive the K A1 KML also allows sending XORed keys to the relevant edge nodes and letting the edge nodes do the mixing. This extra degree of freedom can add some security to the scheme.

[0046] The key point here is that KML only has the XORed keys, not the QKD keys. Final processing can only be done locally by the edge nodes. KML acts as a broker, and it can distribute the XORed keys to the edge nodes, but it cannot discover the QKD keys. If KML is hacked or becomes a bad actor, it can prevent A and B from creating keys, but it cannot make A and B believe they have the private key. The QKDN can only be destroyed by the joint action of KML and the core nodes of the TN that may hold the QKD keys. However, the core nodes are designed not to store the QKD keys for long periods of time, and would need to be physically tampered with to do so. By adding an appropriate delay between the generation of a key and its use by KML that is much longer than the maximum time that a QKD key can be stored in a core node, it can be ensured that all the QKD keys are erased before the corresponding XORed keys are used in the exchange. A malicious actor would also need to keep a count of all the keys and know when they are going to be used. Note that if an edge node has been tampered with, it is trivial that the private key cannot be kept there, but this only applies to this particular node.

[0047] In principle, all XORed keys can be exchanged publicly. In practice, it is advantageous to use encryption methods to add an additional layer of security. Today, standard asymmetric encryption (e.g., RSA or ECC) can be used. In the future, it can be updated to the new Post Quantum Cryptography (PQC) that is being standardized at NIST. The use of PQC for KML and QKD at the QKD layer results in a robust system.

[0048] While the embodiments have been described in conjunction with several embodiments, it is evident that many alternatives, modifications, and variations will be or are apparent to those skilled in the applicable arts. Accordingly, the present disclosure is intended to embrace all such alternatives, modifications, equivalents, and variations that are within the scope of the present disclosure. This is the case, for example, particularly with regard to different devices that may be used.

Claims

1. A quantum key distribution network, comprising: A quantum key distribution layer (QKD layer) including a plurality of emitter and receiver pairs and a plurality of core nodes and edge nodes; a key management layer (KML) adapted to exclusively receive XORed keys from the core nodes and transmit the XORed keys to the edge nodes of the QKD layer; Quantum key distribution network.

2. The key management layer does not include or store a QKD key. The quantum key distribution network of claim 1 .

3. providing at least one additional layer of security to the key management layer including standard asymmetric cryptography such as RSA, ECC, or Post Quantum Cryptography (PQC); The quantum key distribution network according to claim 1 or 2.

4. the link between the second node and the key user layer is local and within the protected area; 4. A quantum key distribution network according to claim 1.

5. The core node includes at least two QKD devices and is configured to temporarily store QKD keys, compute the XOR of the QKD keys, and forward the XORed key to the KML.

5. A quantum key distribution network according to claim 1.

6. The core node calculates the XOR of the QKD key and then destroys the corresponding QKD key.

6. A quantum key distribution network according to claim 1.

7. The edge node includes at most one QKD device and is configured to receive an XORed key from the KML, perform another XOR operation with itself and a corresponding QKD key to obtain a final QKD key, and forward the final QKD key to the SL.

7. A quantum key distribution network according to any one of claims 1 to 6.

8. A quantum key distribution network according to any one of claims 1 to 7, comprising: a service layer configured to receive keys from the edge nodes of the quantum key distribution layer, Quantum secure communications network.

9. The link between the edge node and the service layer of the edge node is local and does not leave the protection area; 9. A quantum security communications network as claimed in claim 8.

10. 10. A quantum key distribution method performed in a quantum security communication network according to claim 8 or 9, comprising: generating QKD key pairs between a number of nodes in a QKD layer, at least two of the nodes being edge nodes and at least one of the nodes being a core node; storing the QKD key in the edge node; performing an XOR operation on the QKD key to become an XORed key in the core node; sending the XORed key to the KML for storage; mixing the XORed keys upon request of the edge node to generate a mixed XORed key and sending the mixed XORed key to two edge nodes; performing another XOR operation at the edge node with itself and its corresponding QKD key to obtain a final shared QKD key between the two edge nodes; Characterized in that it comprises Quantum key distribution method.

Images